In LTE (Long Term Evolution) networks, the X2 is a new type of interface, it connects neighboring eNodeBs (Evolved Node B) in a peer to peer fashion to assist handover and provide a means for rapid co-ordination of radio resources.
LTE introduces new transport networking options with direct inter-base-station connectivity, via the X2 interface, between adjacent eNodeBs for handover. As a result, the deployment of a partial mesh network is beneficial, as traffic does not have to flow through a hub site. Intra E-UTRAN (Evolved Universal Terrestrial Radio Access Network) Handover is used to hand over a UE (User Equipment) from a source eNodeB to a target eNodeB using X2 when the MME is unchanged.
FIG. 1 is a flowchart of how Intra E-UTRAN Handover works, as shown in FIG. 1, in the scenario described here Serving Gateway is also unchanged. The presence of IP connectivity between the Serving GW and the source eNodeB, as well as between the Serving Gateway and the target eNodeB is assumed. User plane data on the S1-U interface between the target eNodeB and Serving Gateway is not secure, and could be exposed if the transport network is not physically protected.
In many cases, the operator owns their transport network, and additional security is not needed. However, if user traffic were to traverse a third party untrusted network, then it should be protected. In such situations, 3GPP (3rd Generation Partnership Project) specify IPSec (Internet Protocol Security) Encapsulated Security Payload (ESP) in tunnel mode should be used. Unfortunately, this adds further overhead to the user data. The NGMN (Next Generation Mobile Networks) backhaul group assumes IPSec ESP (Encapsulated Security Payload) adds an additional 14% on top of the transport protocol overhead (making 25% in total).
FIG. 2 is a topology diagram of LTE Trusted Model. As we know, user plane, control plane and management plane must all be protected by IPSec. The requirement for IPSec tunnel and key management is defined in the 3GPP documents TS 33.210[2] and TS 33.31 which discuss the Layer 3 security and authentication framework. These documents require that IPSec ESP conform to RFC 4303 (“IP Encapsulating Security Payload (ESP)”, RFC 4303) to support integrity and replay protection, and that certificate authentication be done by IKEv2 (“Internet Key Exchange (IKEv2) Protocol”, RFC 4306). The reasons for security include: eNodeBs access network shall be authenticated, protecting subscriber specific sessions, pass through unauthorized third parties' networks, integrity of user data over S1-U and X2-U, and confidentiality transport. And the IPSec requirements comprise: according to 3GPP, eNodeB should support IPSec tunnel mode, and IPSec transport mode is optional. Moreover, if S1 & X2 transport is trusted, e.g. physical protection, there is no need for IPSec/IKEv2.
FIG. 3 is a topology diagram of Next Generation Mobile Networks (NGMN). As per NGMN, it is recommended that each eNodeB supports up to 16 S1 interfaces, and each eNodeB supports up to 32 X2 interfaces. In densely populated areas, deployment needs eNodeB to support up to 32 X2 interfaces.
The number of eNodeBs managed by MME increases gradually, and keys used for eNodeB should be updated dynamically. As a result, performance consumption increases during key negotiation between eNodeB.